diff --git a/unraid_mcp/core/setup.py b/unraid_mcp/core/setup.py
index e09d5b6..2d36d90 100644
--- a/unraid_mcp/core/setup.py
+++ b/unraid_mcp/core/setup.py
@@ -29,51 +29,37 @@ class _UnraidCredentials:
     api_key: str
 
 
-async def elicit_destructive_confirmation(
-    ctx: Context | None, action: str, description: str
-) -> bool:
-    """Prompt the user to confirm a destructive action via MCP elicitation.
+async def elicit_reset_confirmation(ctx: Context | None, current_url: str) -> bool:
+    """Ask the user whether to overwrite already-working credentials.
 
     Args:
         ctx: The MCP context for elicitation. If None, returns False immediately.
-        action: The action name (for display in the prompt).
-        description: Human-readable description of what the action will do.
+        current_url: The currently configured URL (displayed for context).
 
     Returns:
-        True if the user accepted, False if declined, cancelled, or no context.
+        True if the user confirmed the reset, False otherwise.
     """
     if ctx is None:
-        logger.warning(
-            "Cannot elicit confirmation for '%s': no MCP context available. "
-            "Re-run with confirm=True to bypass elicitation.",
-            action,
-        )
         return False
 
     try:
         result = await ctx.elicit(
             message=(
-                f"**Confirm destructive action: `{action}`**\n\n"
-                f"{description}\n\n"
-                "Are you sure you want to proceed?"
+                "Credentials are already configured and working.\n\n"
+                f"**Current URL:** `{current_url}`\n\n"
+                "Do you want to reset your API URL and key?"
             ),
             response_type=bool,
         )
     except NotImplementedError:
-        logger.warning(
-            "MCP client does not support elicitation for action '%s'. "
-            "Re-run with confirm=True to bypass.",
-            action,
-        )
+        logger.warning("MCP client does not support elicitation for reset confirmation.")
         return False
 
     if result.action != "accept":
-        logger.info("Destructive action '%s' declined by user (%s).", action, result.action)
+        logger.info("Credential reset declined by user (%s).", result.action)
         return False
 
     confirmed: bool = result.data  # type: ignore[union-attr]
-    if not confirmed:
-        logger.info("Destructive action '%s' not confirmed by user.", action)
     return confirmed
 
 
diff --git a/unraid_mcp/tools/array.py b/unraid_mcp/tools/array.py
index 8d70841..5d2d10c 100644
--- a/unraid_mcp/tools/array.py
+++ b/unraid_mcp/tools/array.py
@@ -11,7 +11,7 @@ from fastmcp import Context, FastMCP
 from ..config.logging import logger
 from ..core.client import make_graphql_request
 from ..core.exceptions import ToolError, tool_error_handler
-from ..core.setup import elicit_destructive_confirmation
+from ..core.guards import elicit_destructive_confirmation
 
 
 QUERIES: dict[str, str] = {
diff --git a/unraid_mcp/tools/keys.py b/unraid_mcp/tools/keys.py
index 7893838..e5ae701 100644
--- a/unraid_mcp/tools/keys.py
+++ b/unraid_mcp/tools/keys.py
@@ -11,7 +11,7 @@ from fastmcp import Context, FastMCP
 from ..config.logging import logger
 from ..core.client import make_graphql_request
 from ..core.exceptions import ToolError, tool_error_handler
-from ..core.setup import elicit_destructive_confirmation
+from ..core.guards import elicit_destructive_confirmation
 
 
 QUERIES: dict[str, str] = {
diff --git a/unraid_mcp/tools/plugins.py b/unraid_mcp/tools/plugins.py
index e9e06f9..7b8bf53 100644
--- a/unraid_mcp/tools/plugins.py
+++ b/unraid_mcp/tools/plugins.py
@@ -10,7 +10,7 @@ from fastmcp import Context, FastMCP
 from ..config.logging import logger
 from ..core.client import make_graphql_request
 from ..core.exceptions import ToolError, tool_error_handler
-from ..core.setup import elicit_destructive_confirmation
+from ..core.guards import elicit_destructive_confirmation
 
 
 QUERIES: dict[str, str] = {